exe extension in url

[Information Services]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Thanks for the information.  Also, just so I can be clear, will there be
more RDJ rules we can be expecting that cover this, and its variants?
(information based on the conversation between James and Martin)

On 1/9/06, Matt Kettler <mkettler at evi-inc.com> wrote:
      James Gray wrote:

      > I have written a number of SpamAssassin rules that increase
      the score for
      > messages that link to executables (exe/dll/bat/etc... but
      NOT ".com"...think
      > about it :P).  Unfortunately some of them also hit
      legitimate websites (like
      > www.ht.com.au which uses a program called "xworks.exe" for
      its dynamic
      > content).

      Suggestion: use a $ to look for uris that END in .exe,
      instead of just looking
      for URIs that contain them. Most dynamic content sites using
      exe have parameters
      passed after it, such as the above site which ends in
      "/xworks.exe?M"


      Something like this would work:


      uri L_URI_EXE /\/.+\.exe$/i
      score L_URI_EXE 0.1
      describe L_URI_EXE Contains link to a .exe file


      >
      > <SHAMELESS_PLUG>
      > All my rules are available at http://files.grayonline.id.au
      - all the URL/URI
      > rules are in the "local_uri.cf" which is in the tar
      ball.  The rest of the
      > instructions are on the website.
      > </SHAMELESS_PLUG>

      Erm, you don't seem to have them in the 12/02/2005 tarball,
      which is the latest
      that's up there.

      ------------------------ MailScanner list
      ------------------------
      To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
      'leave mailscanner' in the body of the email.
      Before posting, read the Wiki (http://wiki.mailscanner.info/)
      and
      the archives (
      http://www.jiscmail.ac.uk/lists/mailscanner.html).

      Support MailScanner development - buy the book off the
      website!



------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!